Cookie Policy

19 September 2026

This page transparently explains how the platform uses cookies and browser local storage.

1. Cookies and local storage

To work, the platform uses two first-party technical cookies, needed to keep you signed in, and browser local storage (localStorage) for essential profile data and some preferences. Technical cookies require no consent and do not track your browsing. In addition, only with consent, it uses Google Analytics analytics cookies (see point 4). We do not use advertising cookies or profiling technologies for advertising purposes. Some pages may also contain videos hosted on YouTube or Vimeo: they are not loaded when the page opens, but only if you press the play button, at which point the provider may set its own cookies (see point 5).

The application is a Progressive Web App (PWA): the browser may install a service worker that caches certain static assets (icons, manifest) for offline use. This cache is technical in nature, requires no consent and does not track the user.

2. What we store on your device

Technical cookies (first-party, sent only over an encrypted connection, lasting 7 days and renewed each time the session is used):
• refreshToken — keeps you signed in without having to log in again. It is httpOnly: no script on the page can read it, not even ours, and it is sent only with authentication requests (path /api/auth);
• hasSession — a simple flag, with value “1”, telling the application that a session may exist so it does not have to query the server on every visit. It contains no identifiers or personal data.

Browser local storage (localStorage):
• user — essential profile data, to display it in the interface;
• session-ended-at — records that you asked to sign out, so the logout is not undone if the network fails;
• originalUser and impersonateUserId — present only on administrative staff devices, during a support operation on an account;
• cookie_consent_v2 — stores your cookie choice (accept or reject);
• i18nextLng — the language selected for the interface;
• bookingState (legacy technical name) — any temporary state while viewing a listing or a request, with no payment;
• casa-di-ale:sidebar-collapsed — sidebar display preference;
• pwaInstallPromptDismissed — remembers whether you have already seen the PWA install prompt;
• pwaPushPromptHandled — remembers whether you have already answered the push notification prompt.

The access token is no longer stored on your device: it lives only in the memory of the browser tab and disappears when you close it or reload the page.

3. Legal basis

Technical local storage is strictly necessary to provide the service and, under the ePrivacy Directive, does not require consent. Google Analytics cookies are installed only with consent through the site banner (Art. 6.1.a GDPR and the ePrivacy Directive). You can withdraw or change analytics cookie choices via "Manage cookies" in the footer. GDPR protections still apply to any personal data involved.

4. Analytics cookies (Google Analytics 4)

With your consent in the site banner we use Google Analytics 4 (provided by Google) to collect, in aggregate and pseudonymised form, statistics on how the site is used: pages visited, traffic source and main interactions with the platform. For this purpose Google sets technical-statistical cookies, in particular _ga and _ga_<id>, lasting up to 2 years. The IP address is anonymised. If you press "Reject" in the site banner, Google Analytics is not loaded; you can change your choice at any time via "Manage cookies" in the footer.

5. Third-party services

When you use certain features, third-party services may set their own cookies or receive technical data from your device: Google and Apple when you choose to sign in with those accounts; Google Analytics only with consent through the site banner; map services when maps are displayed. Processing by these services is governed by their respective notices. When viewing maps (business directory and business details), map tiles are provided by Esri/ArcGIS (services.arcgisonline.com) and, if configured, by MapTiler (api.maptiler.com): both receive the device's IP address and User-Agent.

Embedded videos (YouTube and Vimeo). Pages containing a video do not load it on opening: a preview served from our own servers is shown, and the provider’s player is embedded only if you press the play button. Until then, no data reaches YouTube or Vimeo. When you press the button, the provider receives your IP address, browser and device type (User-Agent) and the referring page, and may set its own cookies or similar technologies. We use the youtube-nocookie.com domain and Vimeo’s Do Not Track parameter, which reduce personalisation but do not remove all processing by the provider, which is governed by their own privacy notices.

6. Management and deletion

You can delete stored data by logging out or clearing local storage and cookies from your browser settings. You can change analytics cookie choices through "Manage cookies" in the footer. You can also consult third-party notices to manage their cookies.

7. Push notifications (Web Push)

If you choose to enable push notifications, the browser stores a push subscription consisting of: a URL endpoint of the browser's notification service, cryptographic keys (p256dh, auth) and technical device information (userAgent). These data are stored on our server and transmitted to your browser's push service (e.g. Google FCM, Mozilla autopush, Apple APNs) to deliver notifications. The legal basis is your explicit consent through the browser permission (Art. 6.1.a GDPR). You can withdraw consent at any time from your user profile (Notifications section): this deletes the subscription from our server and unsubscribes the browser.

8. Contacts

For any question about this Cookie Policy, write to info@civediamoincalabria.it.